51bc7479afed1bfb31ed330d4f7b51e4e220ee36c617e1e81748707e79abcb80

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260424-tmlzdses4y
SHA256 51bc7479afed1bfb31ed330d4f7b51e4e220ee36c617e1e81748707e79abcb80
MD5 50af55e2ae4c52f36a499d2bf24ce489
SHA1 f9a569725202a8c6d28195725d53da79cbf8dc6f
SHA512 45d0906b6bdc6783c990e0d5195a9adad4014deee1ad5b46bc1136f08bad01037c3525a3b14ec69e83ee28569a8afb242d210efefd556c59dda8c8dc1778dfd0
SSDEEP 12288:aO4rfItL8HRDulCe49toyzTojuNJF67K9wlsDpVFd:aO4rQtGR6lCeGt3oujF6+9wlsDpVFd
TLSH
T115A4E12676858233D2D302750BE6DBAAAA3E79751335A0C37BC4023D1F65AE1C77A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3888	FA2F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3888	FA2F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA2F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 3888	4728	2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\FA2F.tmp
  "C:\Users\Admin\AppData\Local\Temp\FA2F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_50af55e2ae4c52f36a499d2bf24ce489_elex_mafia_stealc_tofsee.exe 2B60FAFBBD5E9F28A2563E52B763DA95CA9E197CD9C6D90BDB32B2007C9406DE7478FEAB29AECD5677B6C48CDF3DF342F8E53F5AFBFFB5AC53C6B797708D32B3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FA2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\FA2F.tmp
Size 476KB
SHA256 3195e880a3d7e9afe32ce303154915bdcc8181f2dbf56667c2fb89af94062d01
MD5 f6e31f0f5f3bc849c6b8afbc4acc35aa
SHA1 abe970d9163ff8f860757a3915a96c32c6dd313e
SHA512 346fb13594bc665cfb9dd9b378af0955395ae5f417c26e3468169dbbe2a3007b4ad2e472dd119fb5684575b3d4b139b8c2569375c92731b607d0948d230aa2ae
SSDEEP 12288:aO4rfItL8HRb4XJSnNcIUzbQiqnJUURBaE7K9wlsDpVFd:aO4rQtGRb4wWIEQjnaABaE+9wlsDpVFd
TLSH
T16DA4F12672418133E29301744BEAEBEAA63E7570476A94C33BD4433E2F617E1D336356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download